🔐 Access Control List (ACL)

---

🧠 Top 5 Key Points

1. Traffic Filtering:
   ACLs filter network traffic by allowing or denying packets based on criteria like IP address, protocol, or port.

2. Security Control:
   They help protect networks by restricting unauthorized access to specific network segments or devices.

3. Types of ACLs:

   • Standard ACLs (1–99): Filter traffic based only on source IP address.

   • Extended ACLs (100–199): Filter traffic based on source, destination, and port/protocol.

4. Direction of Application:
   ACLs can be applied inbound (incoming packets) or outbound (leaving interface).

5. Order Matters:
   ACLs are processed top-down; the first match decides the action — unmatched packets are denied by default.

---

⚙️ Technical Summary

Feature	Description
OSI Layer	Layer 3 (Network Layer)
Purpose	Traffic filtering & security
Placement	Router interfaces
Default Behavior	Implicit “deny all” at end
Common Use	Restrict access between subnets or to servers

---

🧰 Packet Tracer Lab – ACL Example

---

🎯 Goal:

Block traffic from one LAN to another while allowing all other traffic.

---

🖥️ Network Topology

PC1 (LAN1) ---- Router ---- PC2 (LAN2)

---

IP Address Plan

Device	Interface	IP Address	Network
R1	G0/0	192.168.1.1	192.168.1.0/24
	G0/1	192.168.2.1	192.168.2.0/24
PC1	NIC	192.168.1.10	192.168.1.0/24
PC2	NIC	192.168.2.10	192.168.2.0/24

---

🪜 Step-by-Step Configuration

🔹 1. Basic Router Configuration

enable
conf t
interface g0/0
 ip address 192.168.1.1 255.255.255.0
 no shutdown
exit
interface g0/1
 ip address 192.168.2.1 255.255.255.0
 no shutdown
exit

---

🔹 2. Create a Standard ACL

Block all traffic from 192.168.1.0/24 (LAN1) to LAN2, but allow others.

access-list 10 deny 192.168.1.0 0.0.0.255
access-list 10 permit any

---

🔹 3. Apply ACL to an Interface

Apply it outbound on interface G0/1 (towards LAN2).

interface g0/1
 ip access-group 10 out
exit

---

🔹 4. Verify ACL Configuration

show access-lists

➡ Displays ACL entries and hit counts.

show running-config

➡ Verifies ACL applied to the correct interface.

---

💡 Testing

• From PC1 (192.168.1.10) → try to ping 192.168.2.10 (PC2) → ❌ should fail (blocked by ACL).

• From Router (or another network) → ping PC2 → ✅ should succeed.

---

🧠 Learning Summary

Concept	Description
ACL Purpose	Filter network traffic
Standard ACL	Based on source IP only
Extended ACL	Based on source, destination & port
Direction	Inbound or outbound
Default Rule	Implicit deny at the end

---

💬 Teaching Tip

“Think of an ACL as a security guard at a router port — it checks every packet’s ID (IP, protocol, port) before letting it pass.”